Researcher Claims Claude Code's Auto Mode Can Be Hijacked by a Simple Website Summary Request

A security researcher at Embrace The Red reports that a routine request to summarise a website can hijack Claude Code Opus 5 when it runs in Auto Mode. Auto Mode replaces human approval prompts with a safety classifier, and the researcher says it has been the default starting mode for Claude Code since mid-August. Using a small sample size, the researcher reports code execution success rates of 60-80%.

The finding sits uneasily with a third-party evaluation commissioned by Anthropic. According to the source, a vendor tested 72 indirect prompt injection scenarios ten times each and showed 0.00% attack success for Opus 5 in Auto Mode. Anthropic's Boris Cherny had said layered defences, including model training, input probes and an intent classifier, could reduce such attacks on unseen cases to approximately zero. The researcher set out to test how that result holds up against a targeted attack chain.

In the test, the web page presented itself as a small archive of notebook records, with a ZIP archive containing plausible metadata, dates and checksums. This gave the AI agent a legitimate-seeming reason to investigate the material. The researcher notes the agent first used a tool that summarises page content, so the server's response steered it toward fetching the page with curl instead, a choice the agent then made on its own. The source article continues beyond this point.